Risk and compliance session

[00:00]Priya Raman: Sorry, I'm on mute. Can you hear me? Right. Fatima, I'll hand to you in a second, I just wanted to say why I asked for this session.

Fatima Haddad: Please, go.

Priya Raman: I've got a technology risk sign-off coming and Compass Assist is the thing I can't explain yet. I want one platform, not two. But I don't want a surprise in front of the board risk committee.

Fatima Haddad: Neither do I. So can I be direct? I'm not against it. I'm cautious. Ben's been reading the vendor's public documentation all week and we have a lot of questions.

Ben Okafor: A lot. Mostly short ones.

Change lead: That's helpful. I'd like to leave today with the rules written down, not just the concerns. Can we go through what the assistant does, then what you need to see before you'd say yes?

[00:06]Change lead: In plain terms. In the contact centre, the assistant suggests an answer from approved knowledge articles and drafts a case note. In branches, it summarises a customer's history for the person on the counter. For bankers, it helps prepare for a meeting. It never sends anything or changes a record on its own.

Fatima Haddad: That last sentence is the one I care about. Never on its own.

Ben Okafor: The question I keep asking is where the prompt goes. When an agent asks the assistant something, what leaves the building?

Priya Raman: This is the architectural question. From what Jorge's team has said, it runs inside the Salesforce environment we're contracted to. The prompt and the customer record it's using don't go to a public model.

Ben Okafor: Contracted. Documented. I want it written in our policy, not just in a slide.

[00:14]Fatima Haddad: Let me say what I'd want as rules. First, no customer personal data goes into a prompt anywhere outside Salesforce. So, nobody pastes a customer's details into a free chatbot because the official one is slow. That has to be in the staff guidance, and it has to be in the training.

Change lead: I'll make that a line in the training content and the solution overview. No customer personal data in prompts outside Salesforce.

Fatima Haddad: Second, every drafted piece of text is reviewed by the person before it's used. Every one. I don't want a version where after three months people just click accept.

Ben Okafor: We can't stop people clicking accept. But we can log it.

Fatima Haddad: Log what was suggested and what was saved. Then we can look at it. Yes.

Change lead: The contact centre workshop on last Thursday made the same point, Tom Gallagher asked for the review step as a rule rather than a setting. So you'll have consistent language from both sides.

Fatima Haddad: Good to hear. Third, and this is the structural one. A written approval gate. A formal sign-off from Risk and Compliance before it goes live to anybody. With a test set. We write the test cases, we run them, we see what comes back.

Priya Raman: What would the test cover?

Ben Okafor: Wrong answers, answers that sound right but aren't from the knowledge base, anything that looks like advice, anything that shows information from the wrong customer. Plus tone.

[00:26]Priya Raman: Timing, though. The test set can only be as good as the configuration we give you. When can we hand you something that's close to final?

Ben Okafor: We'd need it for a few weeks.

Fatima Haddad: And I don't want to sign off while UAT is still running and the guardrails are still moving. But I also don't want to do it the week before go-live.

Change lead: The current plan has UAT closing mid-March and Wave 1 go-live on Monday 19 April. If the gate sits at the end of March, you get UAT outputs and about three weeks before go-live. Is that a fair working assumption?

Fatima Haddad: It's a working assumption. I'm not going to confirm a date in a meeting. Let me go away and look at what the test set needs and then I'll confirm. By the end of next week, the twenty-ninth.

Change lead: The twenty-ninth of January. And I'll put the approval gate onto the go/no-go checklist as a criterion, with the date as a placeholder until you've confirmed it. That'll be done by Friday.

[00:37]Ben Okafor: Can I ask something that's not on your list? Complaints.

Fatima Haddad: Go on.

Ben Okafor: The contact centre team mentioned wanting the assistant to help with complaint letters. A written response to a complaint is a regulated communication. It has to be accurate, it has to be consistent with our obligations, and if it's wrong we've got a problem with the regulator, not just the customer.

Priya Raman: So is the assistant allowed to draft written complaint responses?

Fatima Haddad: That's a real question and I can't answer it today. It's a policy decision, not a technical one. I don't want to say yes because it'd save time and I don't want to say no because I haven't thought it through. Can we hold it as an open question and I'll bring a position?

Change lead: I'll log it as Q-05, owner Risk and Compliance. Do you want a date on it?

Fatima Haddad: No. Not yet. I'd rather get the approval gate sorted first. They're related.

[00:45]Priya Raman: Anything on prompt changes after go-live? Who owns them?

Ben Okafor: Good point. If someone in the platform team edits the instructions the assistant works from, that's effectively a change to the control.

Fatima Haddad: It is. We'd want to see a change process for that. Who. How. Who signs it.

Change lead: That's already on the register in draft as an ownership question. I'll keep it there.

Priya Raman: Fine. We don't have to resolve it today.

[00:52]Fatima Haddad: One more, on the staff side. Some of my team are nervous that the assistant means fewer people in the contact centre. I'd rather the programme got ahead of that.

Change lead: Understood. I'd suggest the first communications are specific about what the assistant does and doesn't do, and that Helen says something about it directly.

Priya Raman: I'll mention it to Helen.

[00:56]Change lead: Read-back. Three rules. No customer personal data in prompts outside Salesforce. Agents review all drafted text. A written approval gate from Risk and Compliance before go-live. Q-05 is open with Risk and Compliance. Fatima confirms the sign-off date by Friday 29 January. I add the gate to the go/no-go checklist by Friday 22 January.

Fatima Haddad: That matches my notes.

Ben Okafor: Mine too. Thanks for getting the rules on paper.

Priya Raman: Thanks all. Right, I've got a board paper I haven't started.